CVE-2026-77780 Unvalidated bank account and card foreign keys in the Prospero Flow CRM transaction save endpoint allow cross-tenant disclosure of banking identifiers

Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus Prospero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and accounting creation permissions to disclose another company's bank account name, bank name and card last four digits via a...

CVE-2026-77780 Unvalidated bank account and card foreign keys in the Prospero Flow CRM transaction save endpoint allow cross-tenant disclosure of banking identifiers

Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus Prospero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and accounting creation permissions to disclose another company's bank account name, bank name and card last four digits via a...

CVE-2026-77780

Roskus Prospero Flow CRM versions 4.9.1 through 5.14.0 contain an authorization bypass (IDOR) in the POST /transaction/save endpoint. A user with transaction and accounting creation permissions can supply a bank_account_id or bank_card_id belonging to another company, and the value is persisted a...

EUVD-2026-63906

Authorization Bypass Through User-Controlled Key in the transaction API in Roskus Prospero Flow CRM 5.0.0 through 5.3.5 allows an authenticated user to read the transactions of other companies on the same instance via an incremented identifier in GET /api/transaction/id, which is resolved without...

CVE-2026-77759

Authorization Bypass Through User-Controlled Key in the transaction API in Roskus Prospero Flow CRM 5.0.0 through 5.3.5 allows an authenticated user to read the transactions of other companies on the same instance via an incremented identifier in GET /api/transaction/id, which is resolved without...

CVE-2026-77759

Roskus Prospero Flow CRM versions 5.0.0 through 5.3.5 contain an IDOR vulnerability in the transaction API. The endpoint GET /api/transaction/{id} resolves transaction identifiers without company scoping or any permission check, allowing an authenticated user to enumerate and read financial trans...

CVE-2026-77759 IDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenant reading of financial records

Authorization Bypass Through User-Controlled Key in the transaction API in Roskus Prospero Flow CRM 5.0.0 through 5.3.5 allows an authenticated user to read the transactions of other companies on the same instance via an incremented identifier in GET /api/transaction/id, which is resolved without...

CVE-2026-77759 IDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenant reading of financial records

Authorization Bypass Through User-Controlled Key in the transaction API in Roskus Prospero Flow CRM 5.0.0 through 5.3.5 allows an authenticated user to read the transactions of other companies on the same instance via an incremented identifier in GET /api/transaction/id, which is resolved without...

CVE-2026-77759 IDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenant reading of financial records

Authorization Bypass Through User-Controlled Key in the transaction API in Roskus Prospero Flow CRM 5.0.0 through 5.3.5 allows an authenticated user to read the transactions of other companies on the same instance via an incremented identifier in GET /api/transaction/id, which is resolved without...

PT-2026-79384

Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus Prospero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and accounting creation permissions to disclose another company's bank account name, bank name and card last four digits via a bank...

PT-2026-79373

Authorization Bypass Through User-Controlled Key in the transaction API in Roskus Prospero Flow CRM 5.0.0 through 5.3.5 allows an authenticated user to read the transactions of other companies on the same instance via an incremented identifier in GET /api/transaction/id, which is resolved without...

CVE-2026-77759: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key in the transaction API in Roskus Prospero Flow CRM 5.0.0 through 5.3.5 allows an authenticated user to read the transactions of other companies on the same instance via an incremented identifier in GET /api/transaction/id, which is resolved without...

CVE-2026-77780: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus Prospero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and accounting creation permissions to disclose another company's bank account name, bank name and card last four digits via a...

CVE-2026-19871

Use of Hard-coded Credentials in the human resources component in Roskus Prospero Flow CRM before 5.15.9 allows unauthenticated remote attackers to authenticate as any employee onboarded through the standard flow, knowing only their email address, because the employee save controller falls back t...

CVE-2026-19871 Use of hard-coded credentials in Prospero Flow CRM employee onboarding

Use of Hard-coded Credentials in the human resources component in Roskus Prospero Flow CRM before 5.15.9 allows unauthenticated remote attackers to authenticate as any employee onboarded through the standard flow, knowing only their email address, because the employee save controller falls back t...

EUVD-2026-58665

Use of Hard-coded Credentials in the human resources component in Roskus Prospero Flow CRM before 5.15.9 allows unauthenticated remote attackers to authenticate as any employee onboarded through the standard flow, knowing only their email address, because the employee save controller falls back t...

CVE-2026-19871

Use of Hard-coded Credentials in the human resources component in Roskus Prospero Flow CRM before 5.15.9 allows unauthenticated remote attackers to authenticate as any employee onboarded through the standard flow, knowing only their email address, because the employee save controller falls back t...

CVE-2026-19871 Use of hard-coded credentials in Prospero Flow CRM employee onboarding

Use of Hard-coded Credentials in the human resources component in Roskus Prospero Flow CRM before 5.15.9 allows unauthenticated remote attackers to authenticate as any employee onboarded through the standard flow, knowing only their email address, because the employee save controller falls back t...

CVE-2026-19871

CVE-2026-19871 affects Roskus Prospero Flow CRM prior to version 5.15.9. The root cause is use of hard-coded credentials where the employee save controller falls back to the literal password “changeme” and the onboarding form lacks a password field, enabling unauthenticated remote attackers who k...

CVE-2026-19871 Use of hard-coded credentials in Prospero Flow CRM employee onboarding

Use of Hard-coded Credentials in the human resources component in Roskus Prospero Flow CRM before 5.15.9 allows unauthenticated remote attackers to authenticate as any employee onboarded through the standard flow, knowing only their email address, because the employee save controller falls back t...